Colorado Enacts New Narrower, Less Burdensome AI Law

On May 14, Colorado Gov. Jared Polis signed Senate Bill 26-189 (the Act), an overhaul of Colorado’s 2024 law governing the use of automated decision-making technology (ADMT), Senate Bill 24-205. Key provisions of the prior bill were stayed by a federal court because of constitutional challenges by Elon Musk’s company xAI and the U.S. Department of Justice that targeted the law’s diversity, equity and inclusion provisions. The Act reenacts the prior bill with amendments, and will take effect on Jan. 1, 2027.

The Act deviates from Senate Bill 24-205 in several key respects, shifting the law’s focus from preventing algorithmic discrimination to promoting transparency and individual rights in automated decision-making.

First, the Act is narrower in scope. It abandons the old law’s broader application to “high-risk artificial intelligence systems.” The Act defines ADMT as “a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores or other information that is used to make, guide or assist a decision, judgment or determination concerning an individual.” Colo. Rev. Stat. § 6-1-1701(2). An AMDT is covered by the bill if it “materially influence[s]” a “consequential decision” or impacts an individual’s “access to, eligibility for, selection for or compensation for” education, employment, housing, financial or lending services, insurance, healthcare services or essential government services. Id. §§ 6-1-1701(3)-(6). The Act suggests the Colorado attorney general promulgate rules defining further what it means to “materially influence” a consequential decision.

The Act also does not apply to employment decisions affecting independent contractors or candidates who are not residents of Colorado. Nor does it cover Colorado candidates if their employers or prospective employers do no business in Colorado.

Second, the Act imposes compliance obligations that are less burdensome. The old law imposed a duty of reasonable care to prevent algorithmic discrimination in the use of artificial intelligence and required employers to implement risk‑management and impact‑assessment programs, conduct annual compliance reviews and publish compliance summaries. The Act abandons those requirements. Instead, the Act simply requires companies to disclose the use of covered ADMTs in consequential decisions to affected candidates, provide certain information and opportunities to individuals who experience adverse outcomes, and maintain records concerning the covered ADMTs’ use.

Specifically, employers who deploy covered ADMTs in connection with consequential employment decisions must disclose that use through a “clear and conspicuous notice.” Id. § 6-1-1704(1). One way to provide such notice is “through a link or posting that is reasonably proximate to the interaction … in which a consequential decision may occur.” Id. § 6-1-1704(2). The disclosure must advise the candidate on how to obtain additional information. Past that, the Act is silent, and we anticipate that forthcoming regulations from the Colorado attorney general will clarify the necessary contents for the notice.

When the use of covered ADMT results in an adverse outcome for the candidate, the employer has 30 days to provide a “description of the consequential decision and the role the covered ADMT played in the consequential decision,” instructions “to request additional information about the covered ADMT and the inputs,” and an explanation of the individual’s rights under the statute. Id. § 6-1-1704(3). In such cases, the applicant or employee may request, and must receive, their personal data used in the consequential decision and correct any “factually incorrect or materially inaccurate personal data’’ but they may not correct “opinions, predictions, scores or protected evaluations” that were “used in a consequential decision that used a covered ADMT.” Id. § 6-1-1705(1). And the employer must provide “an opportunity for meaningful human review and reconsideration of the consequential decision,” but only “to the extent commercially reasonable.” Id. The Act further expressly directs the Colorado attorney general to adopt rules clarifying the post-adverse outcome disclosure requirements.

The Act also requires employers to retain records “reasonably necessary to demonstrate compliance” with the Act, which may include “covered ADMT version identifiers, changelogs and documentation of material mitigation changes.” Id. § 6-1-1703.

Third, the Act clarifies liability for discrimination claims arising from the use of covered ADMT in consequential decisions. Both deployers (i.e., employers, among others) and developers of covered ADMTs may be liable for discriminatory outcomes, but only based on their relative faults; the law does not create joint and several liability. Id. § 6-1-1707(1)-(4). Developers of covered ADMTs may be liable for discriminatory outcomes only if the covered ADMT was used “in a manner that was intended, documented, marketed, advertised, configured or contracted for by the developer.” Id. § 6-1-1707(5). The Act also invalidates indemnification clauses that would shift a developer’s liability for unlawful discrimination to a deployer, and vice versa, but such clauses would be enforceable against a deployer that used the covered ADMT in a manner not intended by the developer. Id. § 6-1-1707(7).

Fourth, the Act expressly states that it does not create a private right of action. Id. § 6-1-1709. The law is enforceable exclusively by the Colorado attorney general under the Colorado Consumer Protection Act. Id. § 6-1-1706. The Colorado attorney general must provide  60 days’ notice of any violation and an opportunity to cure, unless the Colorado attorney general finds the employer knowingly or repeatedly violated the Act. Id. § 6-1-1706(c).

The Act takes effect on Jan. 1, 2027, and instructs the attorney general to adopt implementing regulations on or before that date. The judicial stay of the prior bill’s enforcement expressly extends to any amendments, including the Act. But since the Act excised the provision concerning diversity, equity and inclusion that was the subject of the lawsuit, we anticipate the stay will not delay enforcement of the Act in January 2027.

Paul Hastings is closely monitoring updates. If you have any questions, please do not hesitate to contact any member of our team.